emotet | 318181e786cfa4e1e3b13f4615345a62736d6062886b00b26d476a2e1c4adb21

Analysis

Target
ad8b8762569abe3a6c3eceb65edcee94.dll
Size 660KB
Sample220125-swbpcahhep
SHA256 318181e786cfa4e1e3b13f4615345a62736d6062886b00b26d476a2e1c4adb21
MD5 ad8b8762569abe3a6c3eceb65edcee94
SHA1 963f9ac3f1dd3cf67a6d177a372d19cb06d001fc
SHA512 b6cd688d5634bca2cc1c5f12e1f78ffb5740c816144a4f989ba815878d722c8a4512192e71db69bf1d34079612596309ce50cbc14a76db956433545c5ee977f5
MD5 SHA1 SHA512

Score

10^/10

Family

Botnet

eck1.plain

ecs1.plain

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3392	3484	regsvr32.exe	68
PID 3484 wrote to memory of 3392	3484	regsvr32.exe	68
PID 3484 wrote to memory of 3392	3484	regsvr32.exe	68
PID 3392 wrote to memory of 3820	3392	regsvr32.exe	69
PID 3392 wrote to memory of 3820	3392	regsvr32.exe	69
PID 3392 wrote to memory of 3820	3392	regsvr32.exe	69

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\ad8b8762569abe3a6c3eceb65edcee94.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\ad8b8762569abe3a6c3eceb65edcee94.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\SysWOW64\rundll32.exe "C:\Users\Admin\AppData\Local\Temp\ad8b8762569abe3a6c3eceb65edcee94.dll",DllRegisterServer
    3⤵
    PID:3820

memory/3392-118-0x0000000004720000-0x0000000004745000-memory.dmp

Download